Behavioral task
behavioral1
Sample
1268-71-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1268-71-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230221-en
General
-
Target
1268-71-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
eae51e79e5525beb65220d366e542b50
-
SHA1
56c0b684addc539b3f9fb5eb7ade1e87188948fe
-
SHA256
9f4761b05510b262ff93ccdaafa1478973d6e366f1d6fdaad2867d56c4f46db4
-
SHA512
454e6ca7b9a4fe0a4e9ea24d11df3a13a2208a471e01bb78f2c55bf9ee2aca6c625cc2442446bd1efd37af508ff908ac3b1c814be85770e278334ecaaefce3e8
-
SSDEEP
3072:5TXc65G2xV6fVscbNQJ8+NZ0b+FP9vHVca9:5TXNVV9O8xv1D9
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.flash-tours.gr - Port:
587 - Username:
[email protected] - Password:
abcdef7890!#%&( - Email To:
[email protected]
Signatures
-
Agenttesla family
Files
-
1268-71-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 163KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ